fd3d2ec0df5da28ac053cc12a63a755d16ff6e4f300bc7b975026f073bd9bc34

Analysis

max time kernel
148s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_4f44f90b79eb40d610b75493be1e3574_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Size 149KB
Sample260731-dpckqsbh28
SHA256 fd3d2ec0df5da28ac053cc12a63a755d16ff6e4f300bc7b975026f073bd9bc34
MD5 4f44f90b79eb40d610b75493be1e3574
SHA1 cb100154e8f96e6eb3138ab78d5ea3eb9843b3f2
SHA512 f386bc130d8ce7289f272dcf6974233c6c98e45f047be2580ec380b5089e68dee21e86bd39d28b4003cc233fec7712fff1aec6a4b4978268413c3e9dadcff8fa
SSDEEP 3072:vbuMGq4hOSOVzjsvFu48h3UzQhgM9jVlHkKSmQILckl51bvcY:TGq4sHVneT+BLkKSmoO1rcY
TLSH
T1D9E3E021BAA0D5B2E1533A704871D6B6A92B786127B445C77B981FBD5F702C18E3833F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5140	3f6x7.exe
5796	2026-07-31_4f44f90b79eb40d610b75493be1e3574_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
1540	2026-07-31_4f44f90b79eb40d610b75493be1e3574_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5796 set thread context of 1540	5796	2026-07-31_4f44f90b79eb40d610b75493be1e3574_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_4f44f90b79eb40d610b75493be1e3574_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f6x7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_4f44f90b79eb40d610b75493be1e3574_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 5140	4136	2026-07-31_4f44f90b79eb40d610b75493be1e3574_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	89
PID 5140 wrote to memory of 5796	5140	3f6x7.exe	90
PID 5796 wrote to memory of 1540	5796	2026-07-31_4f44f90b79eb40d610b75493be1e3574_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 5796 wrote to memory of 1540	5796	2026-07-31_4f44f90b79eb40d610b75493be1e3574_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 5796 wrote to memory of 1540	5796	2026-07-31_4f44f90b79eb40d610b75493be1e3574_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 5796 wrote to memory of 1540	5796	2026-07-31_4f44f90b79eb40d610b75493be1e3574_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91
PID 5796 wrote to memory of 1540	5796	2026-07-31_4f44f90b79eb40d610b75493be1e3574_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-31_4f44f90b79eb40d610b75493be1e3574_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_4f44f90b79eb40d610b75493be1e3574_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Users\Admin\AppData\Local\Temp\3f6x7.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-31_4f44f90b79eb40d610b75493be1e3574_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe" H2QwViik
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5140
- - C:\Users\Admin\AppData\Local\Temp\2026-07-31_4f44f90b79eb40d610b75493be1e3574_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\3f6x7.exe" 9wS59Rk2
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\2026-07-31_4f44f90b79eb40d610b75493be1e3574_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee.exe
      hupDk7C0
      4⤵
      Executes dropped EXE
      PID:1540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3f6x7.exe

Path C:\Users\Admin\AppData\Local\Temp\3f6x7.exe
Size 149KB
SHA256 55c40560426835372ab9bf58e074831efcea75fc6960f00d9e4c99e82667c347
MD5 a6ab602f76b363da3456c10baabf9a19
SHA1 c7a5c52ce8ab2b06b6360d22881e75b2ae22dc42
SHA512 9ce4f851333da931b38820a0bc72865116148b52bd9654c1c72f71262948183c646bf099b55149c248a818c19511c18cfc385eee22103874026145a0cf8c2a5b
SSDEEP 3072:vbuMGq4hOSOVbjsv5ntuLA646DQNmVpTsw30NbEuK:TGq4sHVPV9Qip/3b
TLSH
T1EEE3D02579508431E553623059B096B2A66F76A213B842CBB7D81FBE6F706C14F3C36F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1540-40-0x0000000000400000-0x000000000049D000-memory.dmp

Download